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IN THE CLAIMS: 

The text of all pending claims, (including withdrawn claims) is set forth below. Cancelled 
and not entered claims are indicated with claim number and status only. The claims as listed 
below show added text with underlining and deleted text with strik e through . The status of each 
claim Is indicated with one of (original), (currently amended), (cancelled), (withdrawn), (new), 
(previously presented), or (not entered). 

Please AMEND claims 1-5, 8-12, 14, 16-19, 21, 23 and 24, CANCEL claims 6, 7 and 25, 
and ADD new claims 26-28 in accordance with the following: 

1 . (CURRENTLY AMENDED) A computer system connected to a data communications 

network, said system comprising: 
a first computer; 

a second, redundant second computer that is independent of the first computer; 

a computer-to-computer connection between Vne first computer and the redundant 
second computer enabling the first computer to match with the redundant second computer by 
comparing a first work result of the first computer with a second work result of the redundant 
second computer; and 

at least one computer-to-network connection to connect both the first and second 
computers to the data communications network independent from the computer-to-computer 
connection so that receipt of any data from the data communications network is limited to the 
first computer and transmission of any data to the data communications network is limited to the 
redundant second computer; wherein at least an initial processing of the data received from the 
data communications network is limited to the first computer, 

wherein the first computer is configured to convert, transmit and to store in the redundant 
second computer non-verified or non-verifiable data received by the first computer only in non- 
processable form, and a virus is detected on the first computer by a comparison of the first and 
second work results, where the first computer is restored to a virus-free state bv copying a state 
of the redundant second computer onto the first computer . 

2. (CURRENTLY AMENDED) The computer system as claimed in claim 1 , wherein the 
first computer is configured to verify the received data in the first computer, and wherein the first 
computer is configured to supply only verified data to the redundant second computer in 
processable form. 
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3. (CURRENTLY AMENDED) The computer system as claimed in claim 1 , wherein the 
first computer and the redundant second computer are configured to independently verify the 
received data, and wherein only matching verified data are stored in the redundant second 
computer in processable form. 

4. (CURRENTLY AMENDED) The computer system as claimed in claim 1 , further 
comprising: a central data memory, 

wherein direct access to internal data of the computer system contained in a central data 
memory is limited to the redundant second computer; and 

wherein the first computer is configured to receive the internal data only upon request via 
the redundant second computer. 

5. (CURRENTLY AMENDED) The computer system as claimed in claim 1 , further 
comprising: an independent, redundant third computer; and 

wherein the redundant second computer is configured to match with the redundant third 
computer by comparing the second work result of the redundant second computer with a third 
work result of the redundant t hird computer. 

Claims 6 and 7 (CANCELLED) 

8. (CURRENTLY AMENDED) The method of claim 26, wherein only the redundant 
second computer directly accesses internal data contained in a central data memory, and 
wherein the first computer indirectly accesses the internal data only upon request via the 
redundant second computer 

9. (CURRENTLY AMENDED) The method of claim 26, further comprising matching the 
second work result of the redundant second computer with a third work result of a third 
computer. 

10. (CURRENTLY AMENDED) The computer system as claimed in claim 1, wherein 
connection between the first computer and the redundant second computer forms an internal 
network of the computer system and wherein the data communications network is an external 
network with respect to the computer system. 
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11 . (CURRENTLY AMENDED) The computer system as claimed in claim 1 , wherein the 
first computer independently verifies the received data producing the first work result and 
wherein the redundant second computer independently verifies the received data producing the 
second work result. 

12. (CURRENTLY AMENDED) The computer system as claimed in claim 1 , wherein 
data processed by the first computer produces the first work result and wherein data processed 
by the redundant second computer produces the second work result. 

13. (PREVIOUSLY PRESENTED) The computer system as claimed in claim 12, 
wherein the first and second work results are produced by executing at least one of horizontal 
parity checks and parallel balancing. 

14. (CURRENTLY AMENDED) The computer system as claimed in claim 1, wherein 
said matching by the first computer with the redundant second computer is performed at an end 
of a program or when memory is being accessed. 

15. (PREVIOUSLY PRESENTED) The computer system as claimed in claim 1 , wherein 
all of the initial processing is performed by the first computer. 

16. (CURRENTLY AMENDED) The method as claimed in claim 26, wherein connection 
between the first computer and the redundant second computer forms an internal network of 
a[[the]] computer system and wherein the data communications network is an external network 
with respect to the computer system. 

17. (CURRENTLY AMENDED) The method as claimed in claim 26, wherein the first 
computer independently verifies [[the]] received data producing the first work result and wherein 
the redundant second computer independently verifies the received data producing the second 
work result. 

18. (CURRENTLY AMENDED) The method as claimed in claim 26, wherein data 
processed by the first computer produces the first work result and wherein data processed by 
the redundant second computer produces the second work result. 
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19. (CURRENTLY AMENDED) The method as claimed in claim 26, wherein a match 
said match i ng by the first computer with the redundant second computer is performed at an end 
of a program or when memory is being accessed. 

20. (PREVIOUSLY PRESENTED) The method as claimed in claim 26, wherein all of the 
initial processing is performed by the first computer. 

21. (CURRENTLY AMENDED) The method as claimed in claim 26, further comprising 
matching the redundant second computer matching w ith ffall an independent, redundanty 
i nd e p e nd e nt third computer by comparing the second work result of the redundant second 
computer with a third work result of the redundant t hird computer. 

22. (PREVIOUSLY PRESENTED) The method as claimed in claim 21 , wherein only the 
second and third computers have access to internal data of the computer system and wherein 
the redundant third computer is configured to implement operation and monitoring of an 

automation system. 

23. (CURRENTLY AMENDED) The computer system as claimed in claim 5, wherein 
user inputs are supplied via a keyboard or a mouse in parallel to the first computer, the second 
redundant computer and the redundant t hird computer. 

24. (CURRENTLY AMENDED) The method as claimed in claim 21, wherein user inputs 
are supplied via a keyboard or a mouse in parallel to the first computer, the redundant second 
computer and the redundant t hird computer. 

25. (CANCELLED) 

26. (NEW) A method, comprising: 

establishing a computer-to-computer connection between a first computer and a 
redundant second computer; 

comparing a first work result of the first computer with a second work result of the 
redundant second computer; 

establishing at least one computer-to-network connection between a data 
communications network and both of the first computer and the redundant second computer. 
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independent from the computer-to-computer connection, so that receipt of any data from the 
data communications network is limited to the first computer, and transmission of any data to the 
data communications network is limited to the redundant second computer; 

limiting at least an initial processing of data received from the data communications 
network to the first computer; and 

transmitting from the first computer to the redundant second computer any non-verified 
data and non-verifiable data received by the first computer only in non-processable form. 

27. (NEW) A method, comprising: 

establishing a computer-to-computer connection between a first computer and a 
redundant second computer; 

comparing a first work result of the first computer with a second work result of the 
redundant second computer; 

establishing at least one computer-to-network connection between a data 
communications network and both of the first computer and the redundant second computer, 
independent from the computer-to-computer connection, so that receipt of any data from the 
data communications network Is limited to the first computer, and transmission of any data to the 
data communications network is limited to the redundant second computer; 

transmitting from the first computer to the redundant second computer any non-verified 
data and non-verifiable data received by the first computer only in non-processable form; 

detecting a virus on the first computer based on a comparison result of said comparing of 
the first and second work results; and 

restoring the first computer to a virus-free state, if a virus is detected, by copying a state 
of the redundant second computer onto the first computer. 

28. (NEW) The method of claim 27, further comprising limiting at least an initial 
processing of data received from the data communications network to the first computer. 
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